A massive credit card breach at a Missouri-based grocery store chain could end up cost $80 million in Illinois alone, according to a court motion filed last week. So far, at least three lawsuits seeking class action status have been filed against Schnucks Markets, Inc., alleging a breach that has affected 2.4 million cards used at 79 stores between early December and late March.

As the St. Louis Dispatch reports:

The suits allege that Schnucks knew about the breach days, perhaps longer, before it revealed the hack, and should have told customers about it sooner. The suit filed in Illinois on April 25 says the breach cost customers time and money, requiring card holders to spend hours canceling and getting replacement cards, and re-setting automatic payments.

In its motion, filed Friday, Schnucks puts a figure on this effort, saying that an estimated 1.6 million card transactions took places at its 23 Illinois stores during the breach period, representing 500,000 unique cards — about one-fifth of the cards compromised in the breach overall.

Plaintiffs argue that state law in Missouri and Illinois says that any store that stores personal data relating to customers must notify those customers as soon as the store becomes aware of a breach. Schnucks, however, says that the data stolen from customer credit cards included card numbers and expiration dates, not names, meaning they were not required to notify victims. It can be said that this looks bad on Schnucks — customer service-wise and reputation-wise.

The case is likely to head to the U.S. District Court for the Southern District of Illinois.

Relatively speaking, $80 million is nothing compared to, say, the Heartland Payments Systems security breach of 2008, which resulted in the theft of information from more than 100 million credit and debit cards and a 20-year prison sentence for the perpetrator. But even that doesn’t compare to this list of the top five most expensive data breaches.

With at least 24 dead and more than 200 injured, the human toll has been massive.

In this video, Moore, Oklahoma, Mayor Glenn Lewis discusses the devastation.

Though difficult, the future of preparing for tornadoes means looking beyond the immediate recovery and tragedy. It means looking for lessons learned and ways to better understand the threat.

Many media outlets are asking the right questions.

Foreign Policy, for example, asked “Why does the U.S. have so many more tornadoes than other countries?” The short answer: It “stems from a mix of climatological, topographical, and geographic factors.”

Such factors mean that the United States averages more than 1,000 reported tornadoes per year while the next-most-hit nation, Canada, only suffers from around 100 reported tornadoes per year. The Wall Street Journal’s contributing meteorologist, Eric Holthaus, broke down some of the weather-reasons that tornadoes occur.

And here is a graphic, from the May issue of Risk Management, that shows where they occur in the United States. The so-called “Tornado Alley.”

(click for larger map)

While the United States’ predisposition to be stuck by tornadoes isn’t questioned by climatologists, a key word is “reported.” In some ways, our ability to understand tornadoes falls behind other natural disasters (namely hurricanes and earthquakes) due to the fact that we still can’t accurately know exactly when or how many tornadoes occur each year. They can be rapidly forming and dissipating funnels of wind, so unless there is someone nearby to witness them or human-made structures to be affected, some go unreported.

Given the progression of development and technology, that is much less so the case in 2013 than it was in 1950. But it is still a factor in our collective ignorance.

For example, the number of reported tornadoes in the United States has risen rapidly over the past 60 years. Some have tried to tie this increase to weather trends or climate change.

But the fact that more are being reported doesn’t necessarily mean more are occurring.

I wrote on the topic for the May issue of Risk Management.

Even in the United States — by far the world’s most frequent victim of twisters — detailed records only go back to 1950. Since then, there has been an average increase of 14 reported tornadoes per year. But any attempt to tie the rise to the weather would be an exercise in analyzing guesswork. Most experts believe this rise is due to advances in science, technology and observational techniques — not to mention the number of homes and businesses that are hit — rather than any objective trend that proves more tornadoes are occurring.

Really, nobody knows — now or then — how many tornadoes occur each year. “Socio-economic factors provide a better explanation for this trend than meteorological ones,” states a report by Lloyd’s of London.

Those who lost loved ones during 2011, a record-setting year for twisters, are unlikely to take solace in this fact. But “despite the anomalous 2011 season,” says the Lloyd’s report, “there is no trend in the number of strong to violent tornadoes between 1950 and 2012.”

In addition to the challenge of knowing how many tornadoes occur, there is the difficulty of predicting when and where they will occur.

The Washington Post‘s Wonkblog, is asking “Why are tornadoes so hard to predict?”

The short answer, from Carbin of the National Weather Service Storm Prediction Center:

“There are so many mild adjustments, slight adjustments that can make a huge difference in whether you end up getting the formation of storms. The sensitivity the atmosphere has to ingredients in the formation of tornados and magnifying that slight change in something we can’t even observe can have a dramatic impact on the forecast.”

Still, despite the limitations, things are improving.

It may not sound like significant progress, but even minutes saves lives.

Just 16 minutes before a gigantic twister first developed near Oklahoma City on Monday, the National Weather Service put out a tornado warning.

The tornado warning issued for the region south of Oklahoma City on Monday, May 20, at 2:46 p.m. (Via Mike Smith)

That doesn’t sound like very much time to get out of the way. For many, it wasn’t: At least 24 people died when the tornado ripped a mile-wide path through the city of Moore, Okla.

But those 16 minutes actually represent an enormous advance for weather science. Back in the 1980s, the average tornado lead time was a scant five minutes. Today, it’s about 13 minutes.

What’s more, meteorologists are now able to issue alerts and storm forecasts even earlier, thanks to powerful computers that allow them to run detailed weather simulations. The Oklahoma City area had been identified as an at-risk area days before the twister actually struck. And the National Weather Service’s Rick Smith issued an eerily prescient forecast at 11:30 a.m. Monday, alerting people to the threat of tornadoes that very afternoon.

Just how much more improvement is possible?

Carbin told the Washington Post that “we might be able to get, say, an hour lead-time on a tornado.”

That time frame, as a goal, sounds depressing. It’s certainly going to make tornadoes forever more difficult to prepare for than, say, hurricanes. But then again, it is a lot better than, say, earthquakes, which generally give zero seconds of notice.

As discussed on Wonk Blog, the world has also gotten better at understanding tornado behavior once a storm forms and is detected. This also adds time for those who might be in a twister’s path in a half an hour as opposed to those who reside near its formation.

A journalist from Arkansas I spoke with yesterday also noted another benefit of being able to better predict where a tornado is headed. Historically, throughout many areas of the South and Midwest, tornado sirens and warnings would be issued for very-large areas. Two whole counties perhaps.

This makes sense. Precaution is obviously the best strategy.

But it also has breed complacency. Some locations face many tornado warnings every year, and if multiple “DEFCON Ones” are declared that never present real threats, people naturally start to take safety for granted. The Boy Who Cried Wolf and all.

With better projections on trajectory and more-precise warning systems, however, sirens only have to be sounded for those who are actually at direct risk of the threat. Those who are likely to remain safe for the next two hours may not have to be told to hunker down in their basements. And in time this should lead to a population who comes to have better respect for the warnings of authorities.

Ultimately, this is all still very difficult science.

The truth is that as tragic as this tornado in Oklahoma has been, there will be more. 2011 was a historic year for twisters and the folks in Joplin, Mississippi, certainly share Moore’s pain. Even past residents of Moore feel the current residents of Moore’s anguish, as another devastating tornado ripped through the same community in 1999.

The hope, however, is that through knowledge, science, preparedness and resiliency, all citizens, municipalities and businesses will be more ready tomorrow than they are today for when the next tornado hits.

Hopefully, the next tragedy can be less tragic.

infographic via @Nightline

Next month marks the 50th anniversary of the Equal Pay Act, which was signed into law by President John F. Kennedy on June 10, 1963. At the time, women earned about 59 cents for every dollar paid to their male counterparts. To correct this disparity, the law made it illegal for employers to pay women lower wages than men for doing the same job.

Today, the gender pay gap has narrowed, but as we reported in the May issue of Risk Management, it still exists. According to the Bureau of Labor Statistics, in 2011, women were paid 82 cents for every dollar paid to men. While a 23% gain is certainly progress, there is still significant ground to be made up before full equality can be achieved.

The pay gap is also evident in the risk management field. Data compiled for the 2013 RIMS Compensation Survey of risk management salaries revealed that, depending on the job title, female respondents took home base salaries that were up to 17% less than their male counterparts in the same position (see the chart below). The discrepancy was greatest with those who handle claims (claims managers and analysts), who made just over 17% less, while all other positions saw gaps of less than 10%. Risk management analysts saw only a 2% gap, while directors of business continuity, financial or IT risk management actually made 2.4% more than men.

What this data seems to suggest is that although women have become leaders in risk management and have long made gender irrelevant in terms of performance, their pay has not always followed suit. If there is a silver lining, though, it is that risk management salaries, for the most part, are more equitable than the national average. Perhaps as the discipline continues to become more prominent and gain greater recognition in corporate boardrooms, the profile of all risk managers will be enhanced and these pay differences will quickly disappear, making risk management an early leader when it comes to fulfilling President Kennedy’s 50-year-old promise of equal pay for equal work.

To see more videos from the conference, click here.

According to AccuWeather, the season should begin quickly after June 1, but isn’t anticipated to start as early as 2012 when two named storms appeared in May. However, 2013 could see stronger storms than last year due to the reduced amount of Saharan dust in the air, which can inhibit a storm’s severity.

In the May issue of Risk Management, Jared Wade wrote about how Floridians feel like they’re overdue for a hurricane having not experienced a landfall since Wilma in 2005. In addition to echoing that concern, AccuWeather.com Expert Senior Meteorologist Dan Kottlowski said that one of the biggest fears regarding the upcoming hurricane season is the effect another major storm would have on the East Coast regions that still haven’t entirely recovered from Superstorm Sandy. Many areas still haven’t rebuilt the protective sand dune barriers that were washed away by Sandy, so another storm would put already reeling communities at an even higher risk for more flood damage.

Overall, AccuWeather’s numbers have been in line with forecasts by other organizations, suggesting that an active season, at least to experts, is almost certain (or at least as certain as any weather forecast can be).

For instance, the United Kingdom’s Met Office expects 14 named storms, nine hurricanes, while in April, Colorado State University’s Philip Klotzbach and William Gray predicted 18 named storms, nine hurricanes and four major hurricanes, and Weather Services International forecasted 16 named storms, nine hurricanes, and five major hurricanes.

As the current Terrorism Risk Insurance Act (TRIA) moves closer to its scheduled expiration date of December 31, 2014, the debate is heating up over whether the federal backstop remains necessary and whether the market demand for terrorism coverage still exists. According to the Marsh 2013 Terrorism Risk Insurance Report, released April 30, demand for coverage has remained both steady and strong. These results only reinforce the need for a long-term extension of the terrorism backstop.

During the first full year of TRIA, only 27% of organizations obtained terrorism coverage as the market was still adjusting to the TRIA program and the fallout from the 9/11 attacks. Since that time, take-up rates have grown steadily. By 2005 the take-up rate for terrorism insurance was 58%. Today the rate is more than 60%—where it has been since 2009. The take-up rates are highest among companies with total insured value (TIV) over $500 million, but even those companies with less than $100 million in TIV obtained terrorism insurance at a 59% rate in 2012.

Take-up rates did vary amongst different industry sectors. Companies within the media, education, financial institutions, health care or nonprofit sectors obtained terrorism coverage at a rate above 70% during 2012, with the media sector leading the way with an 81% take-up rate. The food and beverage, manufacturing, chemical and energy and mining and sectors were at the low end with take-up rates of 50% or lower.

With regard to region, companies located in the Northeast were most likely to obtain terrorism insurance with a take-up rate of 77% in 2012. This is to be expected given the concentration of large metro areas with high population density. However, other regions are showing a strong need for coverage as well. Companies located in the South, West and Midwest regions obtained coverage at the rates of 63%, 53%, and 58% respectively in 2012. The threat of terrorism is not just a Northeast problem, and companies in regions with a less-perceived threat of terrorism are showing recognition of that fact.

If TRIA is allowed to expire, these numbers could change drastically as capacity would be significantly decreased. Without TRIA, insurers would no longer be required to offer terrorism coverage. The Marsh report shows that terrorism pricing, as a part of property premiums, has remained within the 3-5% range since 2010. Premiums would likely rise, however, without TRIA, and the certainty it provides insurers essentially subsidizes current rates. Additionally, companies with a high exposure concentration in central business districts or major metropolitan areas would likely not be able to purchase the necessary amount of coverage, forcing them to self-insure all or part of their terrorism risks.

The Marsh report covers many other issues surrounding the terrorism market that are not discussed here, including: considerations in using captives for terrorism coverage; the terrorism reinsurance market; the standalone terrorism market; and implications on workers compensation and general liability coverage if TRIA were allowed to expire.

Risk Management Monitor: Has the idea of the role of risk manager been lost? How so?

Michael Lopez: I don’t think so at all. If anything, I think we’re seeing a new appreciation for the profession. Historically focused in insurance and finance, risk is taking on a broader definition, from homeland security to business operations to social issues. If anything, we might be seeing the scope increase too broadly and thus we’ve got some confusion about what a risk manager is and what they do.

In a general sense, we’re all risk managers. We are all constantly evaluating risk and making decisions as a result. Most of us don’t even know we’re doing it. Because of that, some business or organizational leaders don’t think they need a risk manager because they do it themselves. Alternatively, some leaders outsource the role all together. Reality, of course, is always somewhere in between. With enough training and confidence, risk managers can exploit this ambiguity by creating their own role and demonstrating value in ways that are unique to, and appreciated by, the organization. Personally, I’ve never wanted a job that is too strictly defined. I believe the expansion of risk-related roles is opening up new opportunities in a very positive way.

RMM: Why is the role of a risk manager unique?

ML: What I personally like about risk is the intersection between the quantitative and the qualitative. Risk is an art and a science and I believe the truly great risk managers have both. I’ve seen many solid, quantitatively-oriented risk managers that are critical to a business or an organization. I’ve also seen risk managers that are charming and able to tailor communication in very influential ways. But I would say that those risk managers that rise to even greater levels of influence and impact in an organization are the ones that combine a quantitative orientation with an appreciation for the soft skill required to proliferate risk in an organization. Monte Carlo simulations, for example, can be a valuable decision making tool, but if senior management doesn’t know how to use it, it’s meaningless. Likewise, a persuasive communication style is valuable, but if you’re not able to interpret risk data, you’re little more than an interesting conversation partner. There’s a balance between these skills that I believe makes a risk manager truly unique.

RMM: What is the one key attribute of a great risk manager?

ML: Without question—perseverance. Risk management can be a challenging profession. It’s not for those that take failure personally or get discouraged easily. It requires a thick skin. It requires courage to sometimes tell a senior leader what they don’t want to hear. At some point, this role will require you to make a call; to get out from behind the data, from underneath the analysis, and make a decision. A great risk manager has the ability to overcome resistance and not let failure reduce their enthusiasm for continuing to push the program or project forward.

RMM: Have you seen the risk manager’s role move from strictly analytics to a more strategic thinking role?

ML: I think the expansion of the role presents both opportunities for future risk managers but also presents some challenges. With the expansion and variety of opinion on the value of risk, I believe we’re witnessing a challenge with the risk managers themselves. I’ve noticed many strong, junior risk managers question the overall direction of the profession. They often ask, “Can I ever be more than just a risk manager?” The answer of course should be yes. Unfortunately, we’ve either stereotyped the risk manager one level up the back office, green-eye shade role, or communicated an artificial ceiling between risk managers and more senior level roles.

I do believe that the chief risk officer position has helped with this to some degree, but I think we as leaders in the profession, need to do better at helping younger risk managers see the potential and the future possibilities. We need to let them know that being analytical is the price of entry of the profession, but leadership positions require that they bring this blend of art and science to the organization. I’ve often said that risk is the ultimate back stage pass in an organization. As the risk manager, I should be able to peek into any aspect of an organization or business. But the narrow focus of the historical role doesn’t really empower the modern risk manager to strive for greater.

RMM: Are the traits that make a successful risk manager and successful leader vastly different?

ML: They are, in fact, quite similar. As noted in a paper I authored two years ago, there are several characteristics of successful risk managers that are also traits of strong leaders: Flexibility, influence, communication and perseverance. These are all required of leaders and required in spades of risk managers. There are several outstanding studies on leadership, and while it’s easy to find any number of perspectives that support or refute the overlap of risk manager and leader qualities, I like to think of it as the most basic level.

Leadership, in my opinion, can be defined by answering the following question: Do people follow you? People follow you because they comprehend and believe in shared ideals, goals, values or purposes that you communicate. In order to be a successful risk manager, you must get people to follow you. Plain and simple. They must believe risk has value. They must see that value. And they must proliferate that view throughout the organization.

(To register for Michael Lopez’s session during World Risk Day, click here)

From the Property Casualty Insurers of America:

The following is a list of allocated funds by the Department of Interior. The complete list of approved projects can be viewed here.

• $42.35 million: The amount New Jersey will receive from the Department of Interior. The funds will be used to repair and rebuild parks, refuges and other federal assets damaged by the storm
• $104.9 million: A portion of this amount will go to New Jersey for multistate projects.
• $2.85 million: The amount allocated to New Jersey by the Bureau of Safety and Environmental Enforcement to make repairs to the Ohmsett oils pill research facility in Leonardo, New Jersey.

For a look at how the property/casualty industry was affected by Sandy, we turn to the Insurance Information Institute for this chart illustrating the p/c industry net income for fourth quarters from 2007-20012.

The National Hurricane Center and the Federal Emergency Management Agency supplied these Hurricane Sandy funding numbers.

• $1.4 billion: The amount the Small Business Administration has loaned to homeowners, renters and businesses in New York. New Jersey received $731 million.
• $3.4 billion: The amount the National Flood Insurance Program has paid in New York claims. Another $3.3 billion was paid in the state of New Jersey.
• $959 million: The amount the Federal Emergency Management Agency paid out for housing assistance in New York. $387.4 in housing grants was given to to New Jersey residents in need.

For a breathtaking photo essay on the effects of Hurricane Sandy, head to Boston.com.

Jeff Hearn, managing director of International Finance Facility, talks about the rising interest in treasury risk management training and how companies are shifting their thinking in terms of using hedging strategies to manage treasure risk.

May 14, 2013, marks the annual event known as World Risk Day. In its second year, the event aims to bring together industry thought leaders and peers to gather together virtually to discuss the major trends, challenges and best practices in risk management. This year’s WRD is themed “Shattering the Project Myth.”

World Risk Day is open to anyone who wants to learn how taking smarter risks can drive their business. The official website includes:

• Virtual Summit: The centerpiece of the first annual World Risk Day, the virtual summit will bring together a unique program of global risk thought leaders who will share
• Resource Center: Visitors can access reports and whitepapers on all aspects of risk management, from embedding a risk management culture to managing risk in government.
• Blog: The World Risk Day blog offers commentary on the event and risk management issues in general and encourages readers to share their experiences and opinions.
• Newsroom: Offers coverage of press releases, supporter announcements and media coverage.

Some of the speakers include:

• Lieutenant Barry McNally, Lieutenant Commander Steve Lee, The Royal Navy – “Making the business case for risk management”
• Norman Anderson, President & CEO, CG/LA Infrastructure – “What lessons can be learned from the world’s Top 100 infrastructure projects?”
• Christoph Schwager, Chief Risk Officer, EADS – “Developing a holistic approach to risk management”
• Rob Halstead, Head of Risk Management, Crossrail – “Strategies for successful collaborative risk management with contractors and the supply chain”
• Chris Bell, Chief Marketing Officer, Active Risk – “Shattering the project myth – managing cost and schedule alone doesn’t equal project success”
• Michael Lopez, Senior Associate, Booz Allen Hamilton - “What makes a great risk manager and how can risk and project professionals collaborate more effectively?”
• David Hillson, The Risk Doctor – “New concepts in understanding and managing risk in projects”

This free, open-to-all event is sure to be a learning day. If you can’t dial in, we’ll have a recap here on the Monitor.